From 9a1c624d08b68a06917936c362b5dfc2456a11c5 Mon Sep 17 00:00:00 2001 From: Atlas Date: Sat, 11 Apr 2026 09:32:16 -0700 Subject: [PATCH] Create: infrastructure/vm-102-matrix-synapse.md --- infrastructure/vm-102-matrix-synapse.md | 214 ++++++++++++++++++++++++ 1 file changed, 214 insertions(+) create mode 100644 infrastructure/vm-102-matrix-synapse.md diff --git a/infrastructure/vm-102-matrix-synapse.md b/infrastructure/vm-102-matrix-synapse.md new file mode 100644 index 0000000..f902e3a --- /dev/null +++ b/infrastructure/vm-102-matrix-synapse.md @@ -0,0 +1,214 @@ +--- +created: '2026-04-11T16:32:16+00:00' +id: 96c4de5f-0dd1-4cdb-a13d-dca95cf3ebcb +keywords: +- matrix.pfi.local +- synapse +- element-web +- 10.250.50.70 +- VM-102 +- PFI-ANA-Docker +- postgres:16 +- appservice +- AIPA +links: [] +modified: '2026-04-11T16:32:16+00:00' +summary: Docker deployment of Synapse homeserver with PostgreSQL and Element Web on + VM 102 (PFI-ANA-Docker). Covers compose file, configuration, storage paths, and + admin setup. +tags: +- infrastructure +- pfi +- pfi-ana +- matrix +- docker +- vm-102 +- synapse +- self-hosted +- deployment +title: VM 102 — Matrix Synapse Deployment +--- + +VM 102 (PFI-ANA-Docker, 10.250.50.70) hosts the Matrix stack as the primary human-to-agent communication channel for AIPA. + +## Components + +| Component | Image | Port | Purpose | +|---|---|---|---| +| synapse | matrixdotorg/synapse:latest | 8008 | Matrix homeserver (Client-Server API) | +| synapse-db | postgres:16 | — | Synapse database | +| element-web | vectorim/element-web:latest | 8080 | Web client for users | + +## Storage Paths + +| Host Path | Purpose | +|---|---| +| /opt/docker/compose/synapse/ | Compose file (managed by Dockge) | +| /opt/docker/conf/synapse/ | Configuration files | +| /opt/docker/data/synapse/ | Synapse data (homeserver.yaml, signing keys, appservice reg) | + +### Volumes + +| Volume / Path | Container Path | Purpose | +|---|---|---| +| /opt/docker/data/synapse | /data | Synapse config, signing keys, media store | +| synapse-db-data (named vol) | /var/lib/postgresql/data | PostgreSQL persistent data | + +## Deployment Steps + +### 1. Create directories +```bash +mkdir -p /opt/docker/data/synapse +mkdir -p /opt/docker/conf/synapse +mkdir -p /opt/docker/compose/synapse +``` + +### 2. Generate Synapse config +```bash +docker run --rm \ + -v /opt/docker/data/synapse:/data \ + -e SYNAPSE_SERVER_NAME=matrix.pfi.local \ + -e SYNAPSE_REPORT_STATS=no \ + matrixdotorg/synapse:latest generate +``` + +Do not modify server_name after generation — it is permanent. + +### 3. Edit homeserver.yaml + +```yaml +database: + name: psycopg2 + args: + user: synapse + password: synapse_db_password + database: synapse + host: synapse-db + cp_min: 5 + cp_max: 10 + +enable_registration: false +federation_domain_whitelist: [] + +app_service_config_files: + - /data/aipa_appservice.yaml +``` + +### 4. Docker Compose + +File: /opt/docker/compose/synapse/docker-compose.yml + +```yaml +--- +services: + synapse-db: + image: postgres:16 + container_name: synapse-db + restart: unless-stopped + environment: + POSTGRES_USER: synapse + POSTGRES_PASSWORD: synapse_db_password + POSTGRES_DB: synapse + POSTGRES_INITDB_ARGS: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C" + volumes: + - synapse-db-data:/var/lib/postgresql/data + networks: + - synapse-net + healthcheck: + test: ["CMD-SHELL", "pg_isready -U synapse"] + interval: 10s + timeout: 5s + retries: 5 + + synapse: + image: matrixdotorg/synapse:latest + container_name: synapse + restart: unless-stopped + depends_on: + synapse-db: + condition: service_healthy + ports: + - "8008:8008" + volumes: + - /opt/docker/data/synapse:/data + networks: + - synapse-net + deploy: + resources: + limits: + memory: 1G + cpus: "2.0" + reservations: + memory: 256M + healthcheck: + test: ["CMD-SHELL", "curl -fsS http://localhost:8008/health || exit 1"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 30s + + element-web: + image: vectorim/element-web:latest + container_name: element-web + restart: unless-stopped + volumes: + - /opt/docker/conf/synapse/element-config.json:/app/config.json:ro + ports: + - "8080:80" + networks: + - synapse-net + +volumes: + synapse-db-data: + +networks: + synapse-net: + name: synapse-net +``` + +Start: `cd /opt/docker/compose/synapse && docker compose up -d` +Verify: `curl http://localhost:8008/health` + +### 5. Element Web config + +File: /opt/docker/conf/synapse/element-config.json + +```json +{ + "default_server_config": { + "m.homeserver": { + "base_url": "http://10.250.50.70:8008", + "server_name": "matrix.pfi.local" + } + }, + "brand": "AIPA", + "default_theme": "dark", + "disable_guests": true, + "disable_login_language_selector": true +} +``` + +### 6. Create admin user +```bash +docker exec -it synapse register_new_matrix_user -u admin -p 'yourpassword' -a http://localhost:8008 +``` + +Agent users (@atlas, @linus, @hermione) are virtual — managed by the appservice. Do not register them as real accounts. + +## Network + +Uses dedicated synapse-net (not traefik-net) because Synapse is accessed directly by IP. If TLS/reverse proxy is needed later, join traefik-net and add Traefik labels. + +## Port Allocation + +| Port | Service | Protocol | +|---|---|---| +| 8008 | Synapse | HTTP | +| 8080 | Element Web | HTTP | +| 8009 | AIPA Bridge | HTTP | + +## Security Notes +- Registration disabled (enable_registration: false) +- Federation disabled (federation_domain_whitelist: []) +- as_token and hs_token are admin-equivalent secrets — store in env.sh, never commit +- For external access, put behind TLS-terminating reverse proxy \ No newline at end of file